t-grease-group
· RFC 8701 §4, RFC 8446 §4.2.7 · extensibility · layer tls · udp/4516 · MUST
Passing this means: Ignored something unknown and carried on.
Anomaly type: transport
How each client answered
| Client | Version | Verdict | What happened |
|---|---|---|---|
| curl | ngtcp2/1.11.0 | Not run | Not attempted. |
| quinn | noq fork | Inconclusive | This test's anomaly is not implemented yet, so the run proves nothing about it either way. |
| aioquic | 1.3.0 | Not run | Not attempted. |
| chromium | build 1223 | Inconclusive | This test's anomaly is not implemented yet, so the run proves nothing about it either way. |
| quic-go | quic-go v0.61.0 | Inconclusive | This test's anomaly is not implemented yet, so the run proves nothing about it either way. |
| quiche | 0.30.0 | Inconclusive | This test's anomaly is not implemented yet, so the run proves nothing about it either way. |
| neqo | 0.31.1 | Inconclusive | This test's anomaly is not implemented yet, so the run proves nothing about it either way. |
What the clause requires
Ignore the unrecognised group and carry on. RFC 8701 reserves these values precisely so that an endpoint meeting one learns to tolerate a future real group sharing the same shape. WITHDRAWN before it ever judged a client, and the reason is worth keeping. It was first built by naming a GREASE value in the ServerHello key_share -- which is not an extensibility test at all. A key_share naming any group the client did not offer is illegal under RFC 8446 §4.1.3 whatever the value is, so every conformant client correctly answered illegal_parameter, and as an Extensibility test demanding tolerance that scored every one of them as a failure. neqo caught it on first contact. That is the exact false accusation this suite exists to avoid, and it would also have duplicated t-group-not-offered, which already measures that rejection properly. The honest version puts the GREASE value where a client genuinely must ignore it -- server supported_groups in EncryptedExtensions, RFC 8446 §4.2.7 -- which rustls does not currently emit at all, so it needs an extension the codec does not yet carry. Held at unimplemented rather than deleted so the port and the id stay stable and the mistake stays on the record.
Judged against RFC 8701, RFC 8446.
Run this one yourself
Every test is reachable from your own client. Nothing here needs an account.
curl -s https://conformance.pqcrypta.com/catalog.json \
| jq '.tests[] | select(.id == "t-grease-group")'What this suite is · The full grid · All clients · All tests · Findings